# CVE-2026-40520: FreePBX api module command injection in initiateGqlAPIProcess

Source: https://junglewise.ai/threats/cve-2026-40520-freepbx-api-module-command-injection-in-initiategqlapiprocess  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-21. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-40520 · Severity: high · CVSS 7.2 · Published 2026-04-21

FreePBX is an open-source graphical user interface that manages Asterisk, a popular voice-over-IP (VoIP) and telephony server. A security flaw in its API module allows an authorized user to execute malicious commands on the server. This could lead to a complete takeover of the phone system, allowing attackers to intercept calls, access sensitive data, or disrupt communications.

Vendors: [FreePBX](https://junglewise.ai/threats/vendors/freepbx).

## Quick answers

**Is CVE-2026-40520 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40520 being exploited in the wild.

**How severe is CVE-2026-40520?** High severity, with a CVSS score of 7.2, published 21 April 2026.

**Which products and versions are affected?** FreePBX Api Module 17.0.8 and prior.

**Is there a fix for CVE-2026-40520?** A patch was published on 2026-04-21: Patch commit 5f194e3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40520 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40520?** Check whether you run FreePBX Api Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the FreePBX 'api' module within the initiateGqlAPIProcess() function. The root cause is the direct passing of GraphQL mutation input fields to the PHP shell_exec() function without proper sanitization or escaping. An authenticated attacker with a valid bearer token can exploit this by sending a GraphQL 'moduleOperations' mutation containing backtick-wrapped shell commands in the 'module' field. Successful exploitation allows for arbitrary command execution on the underlying host with the privileges of the web server user. A patch has been identified in commit 5f194e3.

## Affected products

- FreePBX api module 17.0.8 and prior

## Timeline

- 2026-04-21: disclosed
- 2026-04-21: advisory
- 2026-04-21: patched: Patch commit 5f194e3 released

## References

- [https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/Api.class.php](https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/Api.class.php)
- [https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/ApiGqlHelper.class.php](https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/ApiGqlHelper.class.php)
- [https://github.com/FreePBX/api/commit/5f194e39a47e5481e8947f9694304d32724175f6](https://github.com/FreePBX/api/commit/5f194e39a47e5481e8947f9694304d32724175f6)
- [https://www.vulncheck.com/advisories/freepbx-api-module-command-injection-via-graphql](https://www.vulncheck.com/advisories/freepbx-api-module-command-injection-via-graphql)

## Related threats

- [FreePBX api module OAuth2 authentication bypass](https://junglewise.ai/threats/cve-2026-44237-freepbx-api-module-oauth2-authentication-bypass)